There are a couple of ways that this malware manages to evade detection. Firstly, threat actors often use reputable file hosting services to conceal the origin of their malware and make detection and removal more difficult. Most antivirus programs will only detect malware if the exact link is discovered before the download.

Also, many malicious downloads are password-protected, encoded, and weigh 900MB in size, which complicates analysis in security environments such as sandboxes. Furthermore, such big files can not be uploaded to VirusTotal, allowing the malware to evade early detection.

The operation uses legitimate files and relies on techniques like DLL sideloading or process injection to run its payload. The Infostealers discovered were: